#!/bin/bash

TOKEN_ID=$(openssl rand -hex 3)
TOKEN_SECRET=$(openssl rand -hex 8)
echo "Token ID: $TOKEN_ID"
echo "Token Secret: $TOKEN_SECRET"

TOKEN_ID=ad744c
TOKEN_SECRET=ff23769e94c711d6
# K8S_VIP_DEFAULT=192.168.56.110:8443
# read -p "Type the VIP address (enter default 192.168.56.110:8443) : "  K8S_VIP
# APISERVER_VIP_PROXY=${K8S_VIP:-$K8S_VIP_DEFAULT}
APISERVER_VIP_PROXY=192.168.56.110:8443
MASTER02=192.168.56.12
MASTER03=192.168.56.13
K8S_CLUSTER_NAME=k8s-cluster
CA_CERT=/etc/kubernetes/pki/ca.crt
TMP_KUBECONFIG_PATH=~/k8s/kubeconfig
KUBECONFIG_PATH=/etc/kubernetes/kubeconfig
KUBECONFIG_YAML_PATH=/etc/kubernetes/yaml
KUBELET_CONFIG=--kubeconfig=$TMP_KUBECONFIG_PATH/bootstrap-kubelet.kubeconfig

echo "Configure kubelet.kubeconfig for woker node"
kubectl config $KUBELET_CONFIG set-cluster $K8S_CLUSTER_NAME --server=https://$APISERVER_VIP_PROXY --certificate-authority=$CA_CERT --embed-certs=true
kubectl config $KUBELET_CONFIG set-credentials tls-bootstrap-token-user --token=$TOKEN_ID.$TOKEN_SECRET
kubectl config $KUBELET_CONFIG set-context tls-bootstrap-token-user@kubernetes --cluster=$K8S_CLUSTER_NAME --user=tls-bootstrap-token-user
kubectl config $KUBELET_CONFIG use-context tls-bootstrap-token-user@kubernetes

echo "Copy Bootstrap-kubelet.kubeconfig To Worker Node"
scp $TMP_KUBECONFIG_PATH/bootstrap-kubelet.kubeconfig vagrant@$MASTER02:$TMP_KUBECONFIG_PATH
scp $TMP_KUBECONFIG_PATH/bootstrap-kubelet.kubeconfig vagrant@$MASTER03:$TMP_KUBECONFIG_PATH

sudo mv $TMP_KUBECONFIG_PATH/* $KUBECONFIG_PATH
ssh vagrant@$MASTER02 "sudo mv $TMP_KUBECONFIG_PATH/* $KUBECONFIG_PATH"
ssh vagrant@$MASTER03 "sudo mv $TMP_KUBECONFIG_PATH/* $KUBECONFIG_PATH"

sudo mkdir -p $KUBECONFIG_YAML_PATH
# refer https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/
echo "Bootstrap Token Secret Format"
cat <<EOF | sudo tee $KUBECONFIG_YAML_PATH/bootstrap-token.yaml
apiVersion: v1
kind: Secret
metadata:
  name: bootstrap-token-$TOKEN_ID
  namespace: kube-system
type: bootstrap.kubernetes.io/token
stringData:
  description: "The default bootstrap token generated by 'kubeadm init'."
  token-id: $TOKEN_ID
  token-secret: $TOKEN_SECRET
  usage-bootstrap-authentication: "true"
  usage-bootstrap-signing: "true"
  auth-extra-groups: system:bootstrappers:default-node-token,system:bootstrappers:worker,system:bootstrappers:ingress
EOF


# refer https://kubernetes.io/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/

# enable bootstrapping nodes to create CSR
cat <<EOF | sudo tee $KUBECONFIG_YAML_PATH/create-csrs-for-bootstrapping.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: create-csrs-for-bootstrapping
subjects:
- kind: Group
  name: system:bootstrappers:default-node-token
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: system:node-bootstrapper
  apiGroup: rbac.authorization.k8s.io
EOF

# Approve all CSRs for the group "system:bootstrappers"
cat <<EOF | sudo tee $KUBECONFIG_YAML_PATH/auto-approve-csrs-for-group.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: auto-approve-csrs-for-group
subjects:
- kind: Group
  name: system:bootstrappers:default-node-token
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
  apiGroup: rbac.authorization.k8s.io
EOF

# Approve renewal CSRs for the group "system:nodes"
cat <<EOF | sudo tee $KUBECONFIG_YAML_PATH/auto-approve-renewals-for-nodes.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: auto-approve-renewals-for-nodes
subjects:
- kind: Group
  name: system:nodes
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
  apiGroup: rbac.authorization.k8s.io
EOF

#  自定义ClusterRole "system:kube-apiserver-to-kubelet" 绑定到用户 "kube-apiserver"
cat <<EOF | sudo tee $KUBECONFIG_YAML_PATH/apiserver-to-kubelet-rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: system:kube-apiserver-to-kubelet
rules:
  - apiGroups:
      - ""
    resources:
      - nodes/proxy
      - nodes/stats
      - nodes/log
      - nodes/spec
      - nodes/metrics
    verbs:
      - "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: system:kube-apiserver
  namespace: ""
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:kube-apiserver-to-kubelet
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: kube-apiserver
EOF

# su 切换root执行
KUBECONFIG_YAML_PATH=/etc/kubernetes/yaml
kubectl apply -f $KUBECONFIG_YAML_PATH/bootstrap-token.yaml
kubectl apply -f $KUBECONFIG_YAML_PATH/create-csrs-for-bootstrapping.yaml
kubectl apply -f $KUBECONFIG_YAML_PATH/auto-approve-csrs-for-group.yaml
kubectl apply -f $KUBECONFIG_YAML_PATH/auto-approve-renewals-for-nodes.yaml
kubectl apply -f $KUBECONFIG_YAML_PATH/apiserver-to-kubelet-rbac.yaml

# kubectl get secret -n kube-system --kubeconfig /etc/kubernetes/kubeconfig/admin.kubeconfig
# kubectl get clusterrolebinding --kubeconfig /etc/kubernetes/kubeconfig/admin.kubeconfig